Symlink-following arbitrary write via github_workflows module

A local attacker who shares the scan output directory with the BBot process can pre-plant a symlink at the predictable `output_dir/owner/repo` path. When the `github_workflows` module later writes workflow logs or artifacts to that path, the write follows the symlink and lands in an attacker-chosen location [ref_id=1]. This is a classic symlink-follow / time-of-check-time-of-use vulnerability where the attacker controls the repository name used in path construction.

The `github_workflows` module in `bbot/modules/github_workflows.py` constructs output paths from user-controlled `owner` and `repo` names without validating for symlinks. The `download_run_logs()` and `download_run_artifacts()` methods build `folder = self.output_dir / owner / repo` and call `self.helpers.mkdir(folder)` without checking whether any path component is a symlink [patch_id=6466801].

The patch adds a `_check_output_path()` method that walks each path component between the trusted `output_dir` and the target folder, calling `current.is_symlink()` on every intermediate directory [patch_id=6466801]. If any component is a symlink, the method returns `False` and the caller (`download_run_logs` or `download_run_artifacts`) aborts the write. This prevents the attacker's pre-planted symlink from being followed, closing the arbitrary-write vector.